Hybrid ququart-encoded quantum cryptography protected by Kochen-Specker 

contextuality 
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Quantum cryptographic protocols based on complementarity are nonsecure against attacks in 
which complementarity is imitated with classical resources. The Kochen-Specker (KS) theorem 
provides protection against these attacks, without requiring entanglement or spatially separated 
composite systems. We analyze the maximum tolerated noise to guarantee the security of a KS- 
protected cryptographic scheme against these attacks, and describe a photonic realization of this 
scheme using hybrid ququarts defined by the polarization and orbital angular momentum of single 
photons. 
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Introduction. Quantum key distribution (QKD) pro- 
tocols allow two distant parties to share a secret key 
by exploiting the fundamental laws of quantum mechan- 
ics. However, standard quantum cryptographic protocols 
based on quantum complementarity, such as the Bennett- 
Brassard 1984 (BB84) protocol [J, are not secure against 
attacks in which the adversary imitates complementar- 
ity with classical resources @]. Interestingly, BB84-like 
protocols can be improved to assure "the best possible 
protection quantum theory can afford" by exploiting 
the fact that the Bell Q and Kochen-Specker (KS) Q 
theorems show that the outcomes of quantum measure- 
ments do not admit local and noncontextual descriptions, 
respectively. The extra security provided by the Bell the- 
orem has been extensively investigated [5|47|. However, 
this extra security is based on the assumption that the 
legitimate parties can perform a loophole-free Bell test, 
something which is beyond the present technological ca- 
pabilities and is not expected to be an easy task in the fu- 
ture @ . A similar problem affects recent proposals com- 
bining the KS theorem with entanglement • There- 
fore, it is worth exploring the extra security offered by 
the KS theorem in situations which require neither entan- 
glement nor composite systems, but only single systems 
with three or more distinguishable states. For crypto- 
graphic purposes, the difference between qubits and sys- 
tems of higher dimensionality is this: Whereas in qubits 
different bases are always disjoint, from qutrits onward 
different bases may share common elements. It is this 
property which is at the root of the proofs of Bell and 
KS theorems. 

Here we investigate the experimental requirements for 
obtaining the extra security offered by a KS-protected 



QKD protocol introduced by Svozil based on the 
properties of the simplest KS set of states [l2|. Hence 
we propose to implement such a protocol by adopting 
ququart states encoded in the hybrid polarization-orbital 
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FIG. 1. (Color online) The protocol is based on a KS set of 
18 states which can be grouped in 9 bases represented by 9 
colors. Every state belongs to two different bases. No set of 
18 balls can have all the properties required to imitate the KS 
set; at least two balls must have different symbols. Therefore, 
the imitation can be detected. 



angular momentum four-dimensional space of single pho- 
13l [14J. For this purpose, we introduce the 



ton states 

optical schemes to measure all the states needed to prove 
KS contextuality. The capability of encoding a four- 
dimensional quantum state in a single photon by exploit- 
ing these two different degrees of freedom enables us to 
achieve a high stability and transmission rate in free- 
space propagation. 

Svozil's protocol. The cryptographic protocol intro- 
duced by Svozil in ll| is a variation of the BB84 pro- 
tocol and works as follows: (i) Alice randomly picks a 
basis from the nine available in Fig. [TJ and sends Bob a 
randomly chosen state of that basis, (ii) Bob, indepen- 
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dcntly from Alice, picks a basis at random from the nine 
available and measures the system received from Alice, 
(iii) Bob announces his bases over a public channel, and 
Alice announces those events in which the state sent be- 
longs to the measured basis. Therefore, the probability 
of adopting the same basis is § . (iv) Alice and Bob ex- 
change some of the remaining matching outcomes over 
a public channel to ensure that nobody has spied their 
quantum channel, (v) Alice and Bob encode the four out- 
comes by using four different symbols. As a result, for 
each successful exchange Bob and Alice share a common 
random key. 

The advantage of this protocol over the BB84 protocol 
is that it is protected by the KS theorem against attacks 
in which the adversary replaces the quantum system with 
a classical one. These attacks can be described using a 
classical toy model 0, [ll[ in which, in step (i) , Alice is 
actually picking one of nine differently colored eyeglasses 
(instead of one of the nine different bases in Fig. [IJ and 
picking a ball from an urn (instead of picking one of the 
18 states in Fig. [T]) with two color symbols in it (corre- 
sponding to the two bases the state belongs to). Each 
one of the 9 differently colored eyeglasses allows her to 
see only one of the nine different colors. To reproduce 
the quantum predictions: (a) each of the balls must have 
one symbol Si € {1,2,3,4} written in two different col- 
ors chosen among the 18 possible pairs. Her choice of 
eyeglass decides which symbols Alice can see. (6) All col- 
ors are equally probable and, for a given color, the four 
symbols are equally probable. In step (ii), Bob is actu- 
ally picking one of nine differently colored eyeglasses and 
reading the corresponding symbol. A classical strategy 
like this one can successfully imitate the quantum part of 
the BB84 protocol (see Q for details) but not the proto- 
col described above. The reason is that the requirements 
(a) and (b) cannot be satisfied simultaneously. Figure [1] 
shows how to prepare 18 balls with the minimum number 
of balls not having the same symbol. 

Experimental requirements. As shown in Fig. [TJ the 
minimum number of balls not having the same symbol 
is two out of 18. A ball attack can be detected only in 
those runs in which Alice and Bob pick differently col- 
ored eyeglasses. Therefore, for the set in Fig.Q] the trace 
of such an attack will be a j% probability of Alice picking 
a symbol such that the corresponding interlinked symbol 
(seen only with differently colored eyeglasses) is different. 
As a consequence, to demonstrate that the experimental 
results cannot actually be imitated with balls and to ex- 
perimentally certify the extra security of this KS-based 
QKD protocol, we need an experimental probability w 
of wrong state identification, defined as the probability 
that Bob makes a wrong identification of the state sent 
by Alice when Bob has successfully measured in a correct 
basis, of w < i ps 0.111. 

Implementation using polarization- and orbital angular 
momentum- encoded ququarts. Here we propose a scheme 



for the experimental implementation of the KS-protected 
QKD protocol. To test its feasibility, we need to prepare 
the 18 states, measure each of them in two different bases, 
and obtain an average value of w over the 18 x 2 possibil- 
ities. The condition which must be fulfilled is w < 0.111, 
which corresponds to a mean fidelity value of the trans- 
mission of the state of F = 0.889. In addition, to check 
that any intercept and resend strategy causes a distur- 
bance, one should be able to measure what happens when 
the states are measured in the wrong basis. While in the 
correct basis the probabilities for the four possible out- 
comes are (in the ideal case) 0, 0, 0, and 1, in the wrong 
basis they are either 0, 0, |, and | or 0, |, |, and |. 

Svozil's protocol uses nine sets of four-dimensional 
states defining a 18-state KS set. We propose encoding 
four-dimensional quantum states by exploiting two differ- 
ent degrees of freedom of the same particle, an approach 
that allows us to achieve higher efficiency in the trans- 
mission process. It has recently been demonstrated that 
ququart states can be efficiently generated by manipu- 
lating the polarization and orbital angular momentum 
(OAM) of a single photon [ljj]. In particular, we consider 
a bidimensional subset of the infinite-dimensional OAM 
space, denoted as Oi, spanned by states with OAM eigen- 
value to ~ ±1 in units of H. According to the nomencla- 
ture \<p,4>) = l^wl^o! , where | -) ^ and |-) 0l stand for 
the photon quantum state "kets" in the polarization and 
OAM degrees of freedom, the logic ququart basis can be 
rewritten as: 

{|1>, |2>, |3), |4» -> {\H, +1), \H, -1), \V, +1), \V, -1)}, 

(1) 

where H (V) refers to horizontal (vertical) polarization. 
Following the same convention, the OAM equivalent of 
the basis \H) and \V) is then defined as \h) = (| + 1) + 
| - 1)) and |u) = -^=(| + 1) - | - 1)). Finally, the ±45° 
angle "antidiagonal" and "diagonal" linear polarizations 
are hereafter denoted by the kets \A) = (\H) + \V))/y/2 
and \D) = (\H) - \V))/y/2, while the OAM equivalent is 
denoted by |o) = {\h) + \v))/y/2 and \d) = (\h) - \v))/y/2. 
It is convenient to work with Lagucrre-Gauss laser modes 
(LGo,±i) as OAM eigenstates since, in this case, the 
states (|/i),|u),|a),|d)) will result as the Hermite-Gauss 
modes (HG^o, HGo,i) along the axes and rotated by 45°. 
This feature allows us to easily transform the states by 
an astigmatic laser mode converter [l5|. We stress that 
by choosing a bidimensional subspace of OAM we avoid 
detrimental effects on the state due to the radial con- 
tribution in the free propagation and Gouy-phases as- 
sociated with different OAM values [lj§- Hence a hy- 
brid approach for the encoding of a ququart state, based 
on OAM and polarization, leads to a higher stability 
for the single photon propagation compared to a qu- 
dit implemented only by adopting the OAM degree of 
freedom. According to the previous definitions, a state 
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TABLE I. The ququart states that compose the KS set are divided in nine basis and encoded in polarization and orbital angular 
momentum degrees of freedom by adopting the devices in Fig. [2] Column E identifies whether or not the states are entangled 
states of the two degrees of freedom. Column S specifies the experimental setup to be adopted for the analysis. Column MC 
gives the angle between the horizontal axis and the orientation of the cylindrical lenses of the mode converter MC. Column 
QWP indicates the angle of the quarter wave plate to be inserted after the PSI in Fig. [2}b for the analysis of bases IV and 
IX. WP refers to the type of wave plate to be inserted in the setup: H means half-wave plate and Q means quarter-wave plate. 



(01,02,03,04) of the KS set is implemented as 
cilff, +1) + a 2 \H, -1) + a 3 \V, +1) + aAV, -1) 



(2) 



The coefficients for each state are shown in Table U 
along with the settings needed to analyze each basis. 

Generation. Figure [2] shows the optical schemes for 
the generation and detection of any ququart state of the 
KS set. The generation of the states can be achieved 
by adopting a spontaneous parametric down conversion 
(SPDC) source of pair of photons, as in Fig. [^a), where 
we consider a collinear generation of couples |ff)|V), 
where one of the two photons acts as a trigger for the 
heralded generation of a single photon to be sent to the 



experimental setup. As in 13(, the manipulation of the 



OAM degree of freedom can be achieved by adopting the 
q-plate device [ljl 17 1. On the polarization, the g-plate 



acts as a half-wave plate, while on the OAM it imposes 
a shift on the eigenvalue m — ±2q, where q is an integer 
or half-integer number determined by the (fixed) pattern 
of the optical axis of the device. In order to manipulate 
the OAM subspace o\ = {| + 1), | — 1)}, a g-plate with 
topological charge q— 1/2 should be adopted [l8(. Inter- 
estingly, the fact that the g-plate can entangle or disen- 
tangle the OAM and polarization degrees of freedom can 
be exploited for the preparation of any ququart states. 
In order to generate all the states of the KS set, it is suf- 
ficient to exploit a technique based on a quantum trans- 



ferrer tt — > o\ described in [13j. The OAM eigenmodes 
produced in this way are not exactly LG modes but hy- 
pergeometric Gaussian ones [i9j . Since some of the de- 
tection schemes are based on the properties of Laguerre- 
Gaussian modes, this fact will lead, in some cases, to a 
detection efficiency of around 80%. Thus, in order to 
avoid noise due to different OAM order contributions, it 
is sufficient to insert in the detection stage a g-plate and 
a single- mode fiber connected to the detector (see Fig. [2]). 

Measurement of the KS bases. The bases involved in 
the KS set have different structures as shown in Ta- 
ble HI They can be classified in three groups, depending 
on whether they are composed of separable, entangled 
(between polarization and OAM) or both separable and 
entangled states. 

The detection setup is shown in Figs. [UJb) and (c). 
Their components are a polarizing Sagnac interferometer 
with a Dove prism (PSI) [2(J, an astigmatic laser mode 
converter (MC) [1^1, and a Laguerre-Gauss mode sorter 
(LGS) [2l|. The PSI consists of a Sagnac interferome- 
ter with a polarizing beam splitter as input-output gate 
and a Dove prism that intercepts the two counterprop- 
agating beams and can be rotated around the optical 
axes. This scheme allows us, under appropriate condi- 
tions, to transform an entangled state into a separable 
one. In this case, the prism must be rotated in order 
to add a phase shift of A0 = ir/2 between |ff) and \V) 
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FIG. 2. (Color online) (a) Setup for the generation of ququart states: One of the two photons emitted by SPDC acts as a 
trigger, while the other one is sent to a polarizing beam splitter (PBS), wave plates and a quantum transferrer based on the 
g-plate in order to generate the desired ququart. (b) Setup for the analysis of bases (I-III-IV-IX): The setup in the dotted 
rectangle analyzes the four states of basis I; basis III can be measured by inserting a half- wave plate (HWP) at 7r/8 before the 
PBS. A polarizing Sagnac interferometer (PSI) and a quarter- wave plate are needed to analyze bases IV and IX (adding a HWP 
at 7r/8 before the PSI). (c) Setup for the analysis of bases (II- V- VI- VII- VIII) : The part in the dotted rectangle is suitable to 
sort the four states of all the bases (the gray wave plate can be a HWP or a QWP depending on the particular basis as shown 
in Table HI; this part is sufficient to analyze basis VIII. Basis II can be analyzed by adding a mode converter (MC). Using a 
PSI before the MC makes it possible to analyze bases VI (adding a HWP at 7r/8) and VII. Finally, the states of basis V can be 
sorted by an additional PSI and QWP. The pictures in the three boxes on the right represent the Sagnac interferometer, the 
LG mode sorter, and the cylindrical lens mode converter, respectively. The detection stage consists of a g-plate, a single-mode 
fiber, and a detector. 



(a = 7r/8 in Fig. [5]). For example, the states of basis 
IV are transformed into (\L,a),\L,d),\R,+l),\R,—l)). 
The MC consists of two cylindrical lenses (with the same 
focal length /) at distance f/V2. It allows us to con- 
vert the HG states (\a),\d)) into (| + 1),| - 1)) and, if 
rotated by 45° along the optical axes, to convert (|/i), 
\v}) into (| + 1), | - 1)) HI. The LGS consists of a 
Mach-Zchnder interferometer with a Dove prism in each 
arm. The two prisms are rotated by /? = 7r/4 with re- 
spect to each other. A phase plate (ip = 7r/2) in one of 
the two arms allows us to send | + 1) and | — 1) in the 
two different output ports of the Mach-Zehnder. States 
belonging to sets / — III — TV — IX can be analyzed 
by adopting the scheme reported in Fig. [2jb) with some 
slight modifications related to the specific basis to be 
measured. The scheme in Fig. [2jc) leads to the analysis 
of bases II -V — VI - VII - VIII. All the details on 
the settings of the different measurement devices are in 
Table H 



Conclusions. Device-independent QKD based on 
loophole-free Bell tests are still far in the future. It is 
therefore worth investigating whether quantum contex- 
tuality can produce some extra protection to BB84-likc 
protocols which do not use entangled states. Here we 
have presented a proposal to demonstrate a quantum 
contcxtuality-bascd extra protection against a particular 
attack, requiring neither composite systems nor entan- 
gled states. 
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